What is the CVSS score of CVE-2025-70092?

CVE-2025-70092 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Open Source Point Of Sale are affected by CVE-2025-70092?

Organizations using the Item Kits function of OpenSourcePOS should be aware of moderate risk from CVE-2025-70092, a cross-site scripting vulnerability rated CVSS 5.5.

Is there a public PoC exploit available for CVE-2025-70092?

Yes, a public proof-of-concept exploit is available for CVE-2025-70092. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-70092?

Within 30 days: Identify affected systems running the Item Kits function of OpenSourcePOS and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Open Source Point Of Sale CVE-2025-70092

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-02-12 cve@mitre.org

XSS Open Source Point Of Sale Opensourcepos

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 18, 2026 - 15:45 vuln.today

Public exploit code

CVE Published

Feb 12, 2026 - 23:16 nvd

MEDIUM 5.5

DescriptionCVE.org

A cross-site scripting (XSS) vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Item Name parameter.

AnalysisAI

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects the Item Kits component of Open Source Point Of Sale. A cross-site scripting (XSS) vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Item Name parameter.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.